shimcache-flushed

Description

This query searches for attempts to flush Shimcache, which may indicate anti-forensic or defense evasion activity by an attacker. Author: Vaasudev_Kala Ref: https://blueteamops.medium.com/shimcache-flush-89daff28d15e

Query · kql

DeviceProcessEvents
| where FileName has "Rundll32.exe"
| where ((ProcessCommandLine has_any("ShimFlushCache","BaseFlushAppcompatCache"))
or (ProcessCommandLine has_any (@"#250",@"#46") and ProcessCommandLine has_any ("apphelp.dll","kernel32.dll"))) // checking for ordinals as well
Raw source shimcache-flushed · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: cd90d859-0d8f-458e-9d96-7f2945fe87a6
name: shimcache-flushed
description: |
  This query searches for attempts to flush Shimcache, which may indicate anti-forensic or defense evasion activity by an attacker.
  Author: Vaasudev_Kala
  Ref: https://blueteamops.medium.com/shimcache-flush-89daff28d15e
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Defense evasion
relevantTechniques:
  - T1112
query: |
  DeviceProcessEvents
  | where FileName has "Rundll32.exe"
  | where ((ProcessCommandLine has_any("ShimFlushCache","BaseFlushAppcompatCache"))
  or (ProcessCommandLine has_any (@"#250",@"#46") and ProcessCommandLine has_any ("apphelp.dll","kernel32.dll"))) // checking for ordinals as well

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.